Can't login to domain over VPN network

The domain AAA is in Chicago in subnet 10.10.1.x, and is
linked via router-to-router VPN to an office in
Philadelphia with subnet 10.10.2.x. When I attempt to log
into the AAA domain from a Windows XP workstation in the
Philadelphia office, I get "The local policy of this
system does not permit you to login interactively". Since
the domain controller and other resources (e.g., Exchange)
are in Chicago, users in Philadelphia must be able to log
in. Can anyone tell me what the problem is, and/or how to
fix it?

FYI: the link between the offices appears to be stable; I
can use Terminal Services to access servers in Chicago.

It sounds like your using terminal services too. Make sure your TS group has
permissions to logon locally on the server.

"Dave" <(E-Mail Removed)> wrote in message
news:591d01c4815f$93979e80$(E-Mail Removed)...
> The domain AAA is in Chicago in subnet 10.10.1.x, and is
> linked via router-to-router VPN to an office in
> Philadelphia with subnet 10.10.2.x. When I attempt to log
> into the AAA domain from a Windows XP workstation in the
> Philadelphia office, I get "The local policy of this
> system does not permit you to login interactively". Since
> the domain controller and other resources (e.g., Exchange)
> are in Chicago, users in Philadelphia must be able to log
> in. Can anyone tell me what the problem is, and/or how to
> fix it?
>
> FYI: the link between the offices appears to be stable; I
> can use Terminal Services to access servers in Chicago.

That particular error is related to the logon locally
user right. The AAA domain account must have
permissions to logon locally to the XP machine in
Philadelphia.


"Dave" <(E-Mail Removed)> wrote in message news:
> The domain AAA is in Chicago in subnet 10.10.1.x, and is
> linked via router-to-router VPN to an office in
> Philadelphia with subnet 10.10.2.x. When I attempt to log
> into the AAA domain from a Windows XP workstation in the
> Philadelphia office, I get "The local policy of this
> system does not permit you to login interactively". Since
> the domain controller and other resources (e.g., Exchange)
> are in Chicago, users in Philadelphia must be able to log
> in. Can anyone tell me what the problem is, and/or how to
> fix it?
>
> FYI: the link between the offices appears to be stable; I
> can use Terminal Services to access servers in Chicago.

Are you sure it is a router-to-router vpn? That error usually happens when
the username being used to authenticate is not given dial-in rights on the
Windows server....


"Dave" <(E-Mail Removed)> wrote in message
news:591d01c4815f$93979e80$(E-Mail Removed)...
> The domain AAA is in Chicago in subnet 10.10.1.x, and is
> linked via router-to-router VPN to an office in
> Philadelphia with subnet 10.10.2.x. When I attempt to log
> into the AAA domain from a Windows XP workstation in the
> Philadelphia office, I get "The local policy of this
> system does not permit you to login interactively". Since
> the domain controller and other resources (e.g., Exchange)
> are in Chicago, users in Philadelphia must be able to log
> in. Can anyone tell me what the problem is, and/or how to
> fix it?
>
> FYI: the link between the offices appears to be stable; I
> can use Terminal Services to access servers in Chicago.

I'm pretty new at this - how do I set that login locally
user right? Is it set on the server or on the XP
machine? Thanks in advance!

Dave

>-----Original Message-----
>That particular error is related to the logon locally
>user right. The AAA domain account must have
>permissions to logon locally to the XP machine in
>Philadelphia.
>
>
>"Dave" <(E-Mail Removed)> wrote in message news:
>> The domain AAA is in Chicago in subnet 10.10.1.x, and is
>> linked via router-to-router VPN to an office in
>> Philadelphia with subnet 10.10.2.x. When I attempt to
log
>> into the AAA domain from a Windows XP workstation in the
>> Philadelphia office, I get "The local policy of this
>> system does not permit you to login interactively".
Since
>> the domain controller and other resources (e.g.,
Exchange)
>> are in Chicago, users in Philadelphia must be able to
log
>> in. Can anyone tell me what the problem is, and/or how
to
>> fix it?
>>
>> FYI: the link between the offices appears to be stable;
I
>> can use Terminal Services to access servers in Chicago.
>
>
>.
>

Description: The user attempting to log on does not have the "logon
locally" permission available under Security Settings\Local
Policies\User Rights Assignment\Log On Locally. Modify the appropriate
Group Policy Object in your environment to grant the user or group this
permission.


<(E-Mail Removed)> wrote in message news:
> I'm pretty new at this - how do I set that login locally
> user right? Is it set on the server or on the XP
> machine? Thanks in advance!

If it is a Domain Controller and you are dealing specifically with that,
then it is found at:
Administrative Tools --> Default Domain Controller Security Settings
If you want the focus to be "Domain wide"
Administrative Tools --> Default Domain Security Settings
If it is a Member Server and you are dealing specifically with that, then it
is found at:
Administrative Tools --> Local Security Policies

In any case once you are in the right MMC, then it is listed under "Local
Policies --> User Rights Assignments--> Allow Log on Locally".


--

Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com


<(E-Mail Removed)> wrote in message
news:5f1801c48166$8b2e4850$(E-Mail Removed)...
> I'm pretty new at this - how do I set that login locally
> user right? Is it set on the server or on the XP
> machine? Thanks in advance!
>
> Dave
>
> >-----Original Message-----
> >That particular error is related to the logon locally
> >user right. The AAA domain account must have
> >permissions to logon locally to the XP machine in
> >Philadelphia.
> >
> >
> >"Dave" <(E-Mail Removed)> wrote in message news:
> >> The domain AAA is in Chicago in subnet 10.10.1.x, and is
> >> linked via router-to-router VPN to an office in
> >> Philadelphia with subnet 10.10.2.x. When I attempt to
> log
> >> into the AAA domain from a Windows XP workstation in the
> >> Philadelphia office, I get "The local policy of this
> >> system does not permit you to login interactively".
> Since
> >> the domain controller and other resources (e.g.,
> Exchange)
> >> are in Chicago, users in Philadelphia must be able to
> log
> >> in. Can anyone tell me what the problem is, and/or how
> to
> >> fix it?
> >>
> >> FYI: the link between the offices appears to be stable;
> I
> >> can use Terminal Services to access servers in Chicago.
> >
> >
> >.
> >